Why it matters
Modern attacks are run by organised groups who spend days inside a network before triggering encryption, and often steal data first to add extortion pressure. Recovery depends far more on preparation than on the response in the moment.
What to get right
- Keep offline or immutable backups, and test restoring from them regularly.
- Protect administrator accounts with separate credentials and multi-factor authentication.
- Patch internet-facing systems quickly; exposed VPNs and remote access tools are common entry points.
- Rehearse the response with leadership, including legal, communications and regulatory reporting duties.
Common questions
Should we pay a ransom?
It is a business decision with legal, ethical and practical risks, and payment does not guarantee recovery or deletion of stolen data. Decide your principles before an incident, with legal counsel, rather than under pressure.
Do we have to report a ransomware attack in India?
Generally yes. CERT-In's 2022 directions require covered organisations to report specified cyber incidents, including ransomware, within six hours of noticing them. Sector regulators may impose their own duties too.